Contact tracing is essential but challenging. For instance, we tend to quickly forget where we have been, and whom we have been near.
Digital Contact Tracing in Norway
Smartphones can register locations as well as other phones nearby. The idea behind contact tracing apps is to use this information to track and notify about infections. For instance, when a user is confirmed infected by Covid-19, the system can identify where this person has been, and whom the user has had close contact with.
The tracing apps can immediately and automatically notify all close contacts that the system detects. A reduction in response time to trace probable Covid-19 patients from days to minutes might prevent new infections considerably.
On April 15th, the Norwegian Institute of Public Health (NIPH) launched the app Smittestopp, developed by Simula Research Laboratory.
Summary
- Digital contact tracing can provide earlier notifications to potentially infected individuals, as well as an overview of how the virus is spreading, and whether the measures against it are working. However, the usefulness of tracing apps remains uncertain.
- In April 2020, the Norwegian health authorities launched the app Smittestopp to collect and store sensitive data about users’ state of infection, location, movement, and close contacts. The app was voluntary and time limited, and location data would be automatically deleted after 30 days.
- The Norwegian app opted for centralised data storage, to enable faster and more precise contact tracing. Most European countries have chosen a decentralised model due to privacy concerns.
- Smittestopp had three purposes, but these were neither specified in the regulations nor in the users’ declaration of consent.
- Anonymous data from digital tracking can be re-identified and should not be used by others than the health authorities.
- Whether open source is the best strategy to make the app secure is debated by experts.
Updates
The Norwegian version of this policy brief was published on 8th June 2020. These are later developments:
- On June 12th, the Norwegian Data Protection Authority notified the Norwegian Institute for Public Health that they would temporarily ban the processing of personal data related to Smittestopp. The DPA believed that Smittestopp cannot be considered a proportionate intervention in the user’s privacy. In addition, they stated that GPS tracking does not follow the privacy regulation’s principle of data minimisation. Moreover, DPA was also critical of the fact that a single user’s consent applies to different purposes.
- On June 16th, the Parliament voted that Smittestopp needed to be changed, in order to enable users to provide separate consents for contact tracing on one hand, and knowledge acquisition on the other.
- On September 28th, the Norwegian Institute for Public Health announced that they will terminate Smittestopp and develop a new app, based on the Exposure Notifications System framework developed by Apple and Google
